Threat Intelligence Center

Blueprint diagram of identity-based attack chain: phishing, MFA fatigue, valid accounts, trusted relationship abuse, persistence

The White House is engaging private security firms to conduct offensive hack-back operations against cybercriminal groups, with Scattered Spider named among the actors in scope. The move extends offensive cyber activity beyond federal agencies and raises practical questions for business and IT leaders around attribution, escalation risk, and how retaliatory operations may change attacker behavior.

Schematic of out-of-bounds packet write corrupting cached privileged binary in APM Edge kernel, CVE-2026-43500

Hitachi Energy's APM Edge product is the subject of two tracked vulnerabilities, CVE-2026-43284 and CVE-2026-43500. The affected attack surface is the APM Edge product itself, and no specific industry targeting has been reported. Organizations running APM Edge should inventory deployments, confirm the versions in use, and monitor Hitachi Energy advisories for both CVE identifiers.

Schematic of credential harvesting from CI/CD build runner and force-push into repository after Trivy token exposure

A supply-chain attack has exposed terabytes of credentials. Reporting on the incident names LiteLLM and Trivy among the associated tools. Leaked credential stores of this scale commonly contain API keys, access tokens, and service account secrets, so teams using either component should inventory where they are referenced, rotate affected secrets, and review access logs for unauthorized use.

Circuit diagram of Android notification phishing chain bypassing email gateway to steal credentials

Google's anti-abuse systems blocked over 7 billion unwanted notifications on Android in Q1 2026, revealing how thoroughly attackers have weaponized web push. The channel now delivers phishing, malware, and fake payment requests disguised as system alerts—bypassing your email gateway entirely.

Schematic of CVE-2024-55591 and CVE-2025-24472 authentication bypass chaining across two Fortinet fabric appliances

Gunra ransomware activity has been tied to the exploitation of two Fortinet vulnerabilities, CVE-2024-55591 and CVE-2025-24472, affecting organizations that expose unpatched Fortinet appliances. The campaign is attributed to Gunra alongside Conti and Golden Community, with associated tooling including Gunra ransomware, Conti ransomware, Mega, and OpenSSH.

Technical schematic of GhostDesk attack chain: signed script host to reflective DLL loader to Chrome extension manifest edit

Attackers are distributing counterfeit CCleaner installers that carry a Trojan.Dropper payload. Once executed, the dropper stages GhostDesk and plants a malicious Chrome extension built around background.js and content.js scripts, converting the browser into a credential-stealing surveillance tool that monitors sessions and captures logins.

Schematic of privilege escalation chain from phishing foothold through Windows driver race condition to stolen credentials

Microsoft has addressed nearly 400 security vulnerabilities in a single release, including CVE-2026-62832, CVE-2026-68820, and CVE-2026-72971. Updates of this size stretch patch windows and testing cycles, and systems remain exposed until deployment completes. Here is what the release covers and how to sequence remediation across your environment.

Threat Intelligence Center

White House Enlists Security Firms for Hack-Back Operations on Scattered Spider

CVE-2026-43284 and CVE-2026-43500 Affect Hitachi Energy APM Edge Deployments

Supply Chain Attack Leaks Terabytes of Credentials Tied to LiteLLM and Trivy

Chrome Cuts 7 Billion Unwanted Android Notifications a Day to Fight Abuse

Gunra Ransomware Exploits Fortinet Flaws CVE-2024-55591 and CVE-2025-24472

Fake CCleaner Downloads Drop GhostDesk Trojan That Hijacks Chrome

Microsoft Patches Nearly 400 Security Holes Including CVE-2026-62832

More Articles …

About Us

Areas We Serve

Get the latest news!